Emails from Coinbase will always have the coinbase.com domain name at the end of them. For example, emails from firstname.lastname@example.org, email@example.com, firstname.lastname@example.org, and any other email from the @coinbase.com domain can be trusted.
We also send emails from Coinbase sub-domains. For example, emails from email@example.com or firstname.lastname@example.org are valid. Note that the email address ends in .coinbase.com.
Regardless of sub-domain, we cryptographically sign all of our emails using DKIM and protect our domain against unsigned email with DMARC.